@ericrisco/rsc 2.0.11 → 2.0.13

package/manifest.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.0.11",
+  "version": "2.0.13",
   "counts": {
     "skills": 273,
     "agents": 33,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ericrisco/rsc",
-  "version": "2.0.11",
+  "version": "2.0.13",
   "description": "A guided harness builder that turns your goal into a minimal, verified AI-agent setup using strict best practices.",
   "type": "module",
   "bin": {
@@ -64,5 +64,27 @@
   },
   "publishConfig": {
     "access": "public"
-  }
+  },
+  "rscFixes": [
+    {
+      "fixedIn": "2.0.6",
+      "symptom": "A guard your team disarmed (.rsc/.no-gitmoji and similar) comes back armed after cloning the repo"
+    },
+    {
+      "fixedIn": "2.0.8",
+      "symptom": "rsc doctor reports commandOrphans for skills that are installed, and rsc capabilities shows no skills (macOS/Linux)"
+    },
+    {
+      "fixedIn": "2.0.10",
+      "symptom": "onboard fails with RSC_ONBOARDING_INCOMPLETE: installed agents differ from accepted policy (antigravity, windsurf, cline, roo, continue, amp, jules, zed, aider)"
+    },
+    {
+      "fixedIn": "2.0.11",
+      "symptom": "Stop or PreCompact hook error: Hook JSON output validation failed, and a 'consider compacting' notice repeating after every turn"
+    },
+    {
+      "fixedIn": "2.0.12",
+      "symptom": "Security: session continuation context could come from a different git worktree"
+    }
+  ]
 }

package/scripts/doctor.js

@@ -18,6 +18,7 @@ import { inspectMemoryWiring } from '../targets/memory.js';
 import { metricsSummary } from '../targets/session-memory-core.mjs';
 import { agentPath } from '../targets/agents.js';
 import { projectOptOuts } from '../targets/opt-outs.js';
+import { versionReport } from './lib/versions.js';
 
 // Gates the committed manifest says the team disarmed, still armed here. Read through the same
 // partition the installer uses, so a machine-only switch somebody's older rsc wrote into the
@@ -238,6 +239,9 @@ export function doctor({ target, home, cwd }) {
     // never rewrites somebody's machine — so the only thing owed is saying it out loud, and
     // saying it every run, because a notice offered once per session is a notice missed.
     optOutsNotApplied: optOutsNotApplied(root),
+    // First thing to read on any bug report: a project behind its CLI runs old hooks, and "it is
+    // already fixed" only helps once the fix is in `.rsc/`.
+    versions: versionReport(root),
     // Counted, never interpreted — by spec, the gap log's reader is the user.
     automationGaps: countGaps(root),
     memory,

package/scripts/lib/versions.js

@@ -0,0 +1,31 @@
+import { readFileSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// Which rsc is running, and which rsc this project was last built with. Two different numbers, and
+// the gap between them is where a published fix fails to arrive: hooks are materialized as copies
+// under `.rsc/`, so a release changes nothing in a project until someone syncs it. Nobody could see
+// that gap before — there was no `--version`, and bug reports arrived without one.
+
+const ROOT = join(dirname(fileURLToPath(import.meta.url)), '..', '..');
+export const CLI_VERSION = JSON.parse(readFileSync(join(ROOT, 'package.json'), 'utf8')).version;
+
+/** `.rsc/.version` is written at install and at every sync — the version this project's hooks came from. */
+export function installedVersion(root) {
+  try { return readFileSync(join(root, '.rsc', '.version'), 'utf8').trim() || null; } catch { return null; }
+}
+
+export function isNewer(a, b) {
+  const pa = String(a).split('.').map(Number);
+  const pb = String(b).split('.').map(Number);
+  for (let i = 0; i < 3; i++) {
+    if ((pa[i] || 0) > (pb[i] || 0)) return true;
+    if ((pa[i] || 0) < (pb[i] || 0)) return false;
+  }
+  return false;
+}
+
+export function versionReport(root) {
+  const installed = installedVersion(root);
+  return { cli: CLI_VERSION, installed, behind: Boolean(installed && isNewer(CLI_VERSION, installed)) };
+}

package/scripts/rsc.js

@@ -16,6 +16,7 @@ import { runUpgrade } from './lib/upgrade.js';
 import { diagnose, repair } from './lib/repair.js';
 import { DEFAULT_SKILL_FLOOR, withDefaultSkillFloor } from './lib/default-skill-floor.js';
 import { readManifest, writeManifest } from './lib/manifest-file.js';
+import { versionReport } from './lib/versions.js';
 import {
   normalizeOnboarding, missingOnboardingFields, scanProject,
   buildOnboardingPlan, decodeGoal, encodeGoal, identifyPlan, recommendDeferredComponents,
@@ -23,6 +24,20 @@ import {
 import { applyAcceptedOnboarding, verifyOnboarding, ensureHarnessSkeleton, harnessReadiness } from './lib/onboarding-apply.js';
 
 const rawArgv = process.argv.slice(2);
+
+// `rsc --version` — answered before anything else runs, offline, and in a shape a bug report can
+// paste. Two numbers because there are two things: the CLI you just ran, and the harness this
+// project was built with. When they differ the project is running old hooks, and a fix that was
+// published may simply not be here yet.
+if (['--version', '-v', 'version'].includes(rawArgv[0])) {
+  const v = versionReport(process.cwd());
+  const lines = [`rsc ${v.cli}`];
+  if (v.installed) lines.push(`installed in this project: ${v.installed}${v.behind ? ' (behind)' : ''}`);
+  else lines.push('installed in this project: none');
+  if (v.behind) lines.push('This project runs older hooks than this CLI. To catch up, run here:', '  npx @ericrisco/rsc@latest');
+  process.stdout.write(`${lines.join('\n')}\n`);
+  process.exit(0);
+}
 const GLOBAL_VALUE_FLAGS = new Set([
   '--target', '--technical-level', '--accompaniment', '--project-kind', '--goal', '--goal-base64', '--software-scope', '--accept-plan',
 ]);

package/targets/session-memory-adapter.mjs

@@ -98,15 +98,18 @@ export function handleLifecycle({ target, event, native = {}, cwd, settings } =
   try {
     if (!LOCAL_TARGETS.has(target)) throw new Error(`unsupported memory target: ${target}`);
     if (isRemote(target, native)) return { output: {}, capture: null, remote: true, degraded: false };
-    const project = nearestHarness(resolve(cwd || native.cwd || process.env.RSC_PROJECT_CWD || process.cwd()));
+    // Two answers from one path, kept apart on purpose: `project` is where the journal is KEPT (the
+    // nearest harness), `here` is where the agent WORKS and therefore who the session is.
+    const here = resolve(cwd || native.cwd || process.env.RSC_PROJECT_CWD || process.cwd());
+    const project = nearestHarness(here);
     if (!existsSync(project)) throw new Error('project directory unavailable');
     const config = settings || projectSettings(project);
     if (config.enabled === false) return { output: {}, capture: null, remote: false, degraded: false };
     const id = sessionId(native, target);
     const eventName = hookEventName(target, event, native);
     if (event === 'start') {
-      const started = capture({ cwd: project, sessionId: id, target, event: 'start', settings: config });
-      const resumed = resume({ cwd: project, target, settings: config });
+      const started = capture({ cwd: project, worktreeCwd: here, sessionId: id, target, event: 'start', settings: config });
+      const resumed = resume({ cwd: project, worktreeCwd: here, target, settings: config });
       return {
         output: nativeOutput(target, eventName, resumed.context),
         capture: started,
@@ -117,6 +120,7 @@ export function handleLifecycle({ target, event, native = {}, cwd, settings } =
     }
     const captureInput = {
       cwd: project,
+      worktreeCwd: here,
       sessionId: id,
       target,
       event: event === 'end' ? 'sessionEnd' : event,

package/targets/session-memory-core.mjs

@@ -284,6 +284,12 @@ function readRecords(root) {
 
 export function capture(input = {}) {
   const cwd = resolve(input.cwd || process.cwd());
+  // WHERE the journal lives and WHO the session is are two different questions. `cwd` answers the
+  // first — the nearest harness, so a child with no manifest of its own does not scatter journals.
+  // The second has to be asked of git from where the agent actually works: asked from the harness,
+  // every worktree nested under it came back as the harness itself, and a sibling's record then
+  // "matched exactly". See GHSA-8gjp-3r7c-33f4.
+  const here = resolve(input.worktreeCwd || cwd);
   const config = settings(input.settings);
   if (!config.enabled) return { record: null, path: null, notice: null, compactionHint: false };
   const store = chooseMemoryRoot(cwd);
@@ -299,7 +305,7 @@ export function capture(input = {}) {
   const recordPath = join(store.root, 'sessions', `${storageId}.json`);
   let anchor = readJson(anchorPath);
   let existing = readJson(recordPath);
-  const firstSnapshot = snapshot(cwd, null);
+  const firstSnapshot = snapshot(here, null);
   if (!anchor) {
     anchor = {
       sessionId,
@@ -312,7 +318,7 @@ export function capture(input = {}) {
   }
   if (input.event === 'start' && !existing) return { record: null, path: null, notice: null, compactionHint: false };
 
-  const repo = snapshot(cwd, anchor.baselineHead);
+  const repo = snapshot(here, anchor.baselineHead);
   const editCount = Math.max(0, (existing?.editCount || 0) + (finiteOrNull(input.editDelta, true) || 0));
   const baselineFiles = new Set(anchor.baselineFiles || []);
   const newDirtyPath = repo.files.some((path) => !baselineFiles.has(path));
@@ -419,13 +425,19 @@ export function resume(input = {}) {
   ensureStore(store.root);
   const now = iso(input.now);
   prune(store.root, now, config);
-  const current = snapshot(cwd, null);
-  const records = readRecords(store.root).filter((record) => validAnchor(cwd, record))
+  const here = resolve(input.worktreeCwd || cwd);
+  const current = snapshot(here, null);
+  const records = readRecords(store.root).filter((record) => validAnchor(here, record))
     .sort((a, b) => b.timestamps.updatedAt.localeCompare(a.timestamps.updatedAt));
   let record = records.find((candidate) => candidate.branch === current.branch && candidate.worktree === current.worktree) || null;
   let match = record ? 'exact' : 'none';
+  // Only ever this worktree's own records. The chain used to end in `|| records[0]` — the newest
+  // record in the store, whoever wrote it — which a moved or renamed checkout reached every time,
+  // because its stale records match nothing. A shared store is a place to KEEP several worktrees'
+  // journals, never a reason to hand one of them to another. No continuation is the honest answer
+  // when there is nothing of yours to continue.
   if (!record) {
-    record = records.find((candidate) => candidate.worktree === current.worktree) || records[0] || null;
+    record = records.find((candidate) => candidate.worktree === current.worktree) || null;
     if (record) match = 'nearby';
   }
   const lessons = selectedLessons(store.root, config);

package/targets/session-start.mjs

@@ -266,19 +266,58 @@ function isNewer(a, b) {
   return false;
 }
 
+// "rsc X is out" was being ignored — the maintainer's own workspace sat on 2.0.4 for days with this
+// notice on every session, and two people in two days reported bugs that were already fixed. A
+// version number names nothing anyone recognises. A symptom does: someone who sees a red error after
+// every turn updates the moment they are told that is what the update fixes (`suggest` §3: say what
+// is wrong as a symptom, not as a cause).
+//
+// The symptoms travel for free: the registry's `/latest` document is the published package.json, so
+// its `rscFixes` field — `{ fixedIn, symptom }` — arrives in the response this check already makes.
+// It is text a model will read, so every entry is reduced to one short plain line or dropped.
+const SEMVER_ONLY = /^\d+\.\d+\.\d+$/;
+function fixesSince(list, installed, latest) {
+  if (!Array.isArray(list)) return [];
+  const out = [];
+  for (const item of list) {
+    if (!item || typeof item !== 'object' || typeof item.symptom !== 'string') continue;
+    if (!SEMVER_ONLY.test(String(item.fixedIn))) continue;
+    if (!isNewer(item.fixedIn, installed) || isNewer(item.fixedIn, latest)) continue;
+    const symptom = item.symptom.replace(/[\u0000-\u001f\u007f]+/g, ' ').replace(/\s+/g, ' ').trim().slice(0, 200);
+    if (symptom) out.push({ fixedIn: item.fixedIn, symptom });
+  }
+  return out.slice(0, 8);
+}
+
 if (!process.env.RSC_NO_UPDATE_CHECK) {
   try {
     const installed = readFileSync(join(root, '.rsc', '.version'), 'utf8').trim();
-    let latest = process.env.RSC_LATEST;
-    if (!latest) {
+    let doc = null;
+    if (process.env.RSC_LATEST_JSON) doc = JSON.parse(process.env.RSC_LATEST_JSON);
+    else if (process.env.RSC_LATEST) doc = { version: process.env.RSC_LATEST };
+    else {
       const ctrl = new AbortController();
       const timer = setTimeout(() => ctrl.abort(), 1500);
       const res = await fetch('https://registry.npmjs.org/@ericrisco%2frsc/latest', { signal: ctrl.signal });
       clearTimeout(timer);
-      latest = (await res.json()).version;
+      doc = await res.json();
     }
+    const latest = doc?.version;
     if (installed && latest && isNewer(latest, installed)) {
-      process.stdout.write(`
+      let fixes = [];
+      try { fixes = fixesSince(doc.rscFixes, installed, latest); } catch { fixes = []; }
+      if (fixes.length) {
+        process.stdout.write(`
+===== rsc update available =====
+rsc ${latest} is out — you have ${installed}. It fixes problems this install still has:
+${fixes.map((f) => `  - ${f.symptom} (fixed in ${f.fixedIn})`).join('\n')}
+ACTION: before starting the task, tell the user in one line that the update fixes what they
+may be seeing, and if they say yes, run it in this project:
+  npx @ericrisco/rsc@latest
+================================
+`);
+      } else {
+        process.stdout.write(`
 ===== rsc update available =====
 rsc ${latest} is out — you have ${installed}.
 ACTION: tell the user a new version is available and, if they say yes, run:
@@ -286,6 +325,7 @@ ACTION: tell the user a new version is available and, if they say yes, run:
 (That reinstalls and refreshes the skill content to the latest.)
 ================================
 `);
+      }
     }
   } catch { /* offline / no baseline / parse error → stay silent */ }
 }